T09 · Insecure Skill Coding Practices
- Location
SKILL.md:24- Finding
OAuth Access Token Stored in a Plaintext File Without Required Permission Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 24–37
Vulnerability Type: Plaintext storage of sensitive authentication material
Risk Level: MediumVulnerable Code
markdown Authenticate on first use and store tokens in `~/.canva/tokens.json`. ## API Base URL ```bash https://api.canva.com/rest/v1Authentication
Get access token from local token file:
bash ACCESS_TOKEN=$(cat ~/.canva/tokens.json | jq -r '.access_token')text ### Technical Analysis The skill directs users to persist Canva OAuth tokens in `~/.canva/tokens.json` as plaintext and later read the access token directly from that file. It does not require restrictive permissions for either the containing directory or the token file, nor does it recommend an operating-system credential store. OAuth access and refresh tokens are bearer credentials: possession may be sufficient to authenticate API requests without knowing the user's password. If local permissions, backups, development-environment sharing, or host isolation are misconfigured, another account or process could obtain the token. The skill also does not specify token-safe logging, lifecycle, rotation, or revocation practices. This issue does not by itself grant an external attacker access to the file. Exploitation requires an existing ability to read the user's filesystem, such as access through another local account, an untrusted process running under the same account, an exposed backup, or overly permissive file permissions. ### Attack Path 1. The user completes OAuth authentication, and the integration stores access or refresh tokens in `~/.canva/tokens.json`. 2. The file or its containing directory is created with permissions that allow an unauthorized local principal or process to read it, or the file is exposed through an insecure backup or shared workspace. 3. The attacker reads the JSON file and extracts the access token or refresh token ...[truncated 932 chars]- Remediation
View remediation
Remediation Suggestions
-
Store OAuth credentials in an operating-system credential manager or another encrypted secret store rather than a plaintext JSON file.
-
If file-based storage is unavoidable, create the directory and file with owner-only permissions before writing credentials:
bash install -d -m 0700 "$HOME/.canva" install -m 0600 /dev/null "$HOME/.canva/tokens.json" -
Validate file ownership and permissions before reading the token, and refuse to proceed when the file is accessible by group or other users.
-
Never print, log, commit, or include access or refresh tokens in command output, diagnostics, backups, or shared artifacts.
-
Use the minimum Canva scopes necessary for each workflow and avoid requesting write scopes for read-only operations.
-
Document token expiration, secure refresh, rotation, revocation, and incident-response procedures.
-
Revoke affected credentials and repeat OAuth authorization if unauthorized file access is suspected.
-